Description
OpenStack Compute (Nova) Grizzly 2013.1.4, Havana 2013.2.1, and earlier uses world-writable and world-readable permissions for the temporary directory used to store live snapshots, which allows local users to read and modify live snapshots.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nova | 2013.2.2 | — |
| Debian 13 | nova | 2013.2.2 | — |
| Debian 12 | nova | 2013.2.2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 4 | python-nova +13 | 2013.2.2-2.el6ost | RHSA-2014:0231 |
| Red Hat OpenStack 3 | python-nova +12 | 2013.1.5-2.el6ost | RHSA-2014:0366 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | nova | < 12.0.0a0 | 12.0.0a0 | GHSA-grp5-h379-j75x |
Advisories 2
- RHSA-2014:0231 Red Hat Security Advisory: openstack-nova security and bug fix update Red Hat Security Advisories (RHSA) · Aug 8, 2026
- RHSA-2014:0366 Red Hat Security Advisory: openstack-nova security and bug fix update Red Hat Security Advisories (RHSA) · Aug 8, 2026